Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    13/06/2024, 05:00

General

  • Target

    a3e5d841d9f5d05d54379f2000593a05_JaffaCakes118.exe

  • Size

    1002KB

  • MD5

    a3e5d841d9f5d05d54379f2000593a05

  • SHA1

    e17a8a5b920491f734fcc23196a21aee6404be62

  • SHA256

    5ac90ded16ebe4ad429814e349fcc77f3918d71a2432ec5c88089bde9dad1aee

  • SHA512

    5a7e1d65db314bcd7020ac96abd4dc898d5e109acc42c722fb6be600d7dbea348021ad457cab53e474717bd6df89f62e63b824299c3dc27b0daad34e519e5dbf

  • SSDEEP

    24576:bwbVDOIBEaftjvJmyCcDeDOxg9KRrEyPSocvgZ:GocDSOUKrPevo

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a3e5d841d9f5d05d54379f2000593a05_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a3e5d841d9f5d05d54379f2000593a05_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2964
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://appdown.naver.com/naver/font/NanumFont/setup/NanumFontSetup_TTF_ALL_totalsearch.exe
      2⤵
      • Modifies Internet Explorer Phishing Filter
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2632
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2632 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1500

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c41c648e1e21127daa62d0b0d7a8fbcd

    SHA1

    e0dbb7f796ff95c87ea35a8e82417f250921421d

    SHA256

    23a0c63f139f9705559613f6f77e95fbd854a0c488bf32167285b45e31cac81f

    SHA512

    d462a2481cf1edc679743dc2b21677ab626927167c1d2895d2d2d42232eef1c24bde12fd52d3a3aa58f75e4d18d9d31abf1c9d70978b342a637deb30291db692

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8ee0a74b44d5f7a17ab8828f036e1ca7

    SHA1

    7aff2c6beb4bca94965cdd0d413850233a07536c

    SHA256

    af69f1d0bce6cc82e19ff04631bbd567721d284f11a5272e0233815115c077be

    SHA512

    979c4b94e2bafe667f4eb1059b2fc6072703a294a062ed09692f93db655b4baa6099aa8a79b5b7ed09dc90b5ea1aa42bce067330614f52319bf10a80d884a8f0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    92ed69a9bbb5cdd7864daecb25be9155

    SHA1

    a1cdd30d9094266e03b370ae65abc54f19c094ac

    SHA256

    aeb18bf2e21c2a137617331a14b9e80792fbda9a41cfbc8df2d2d6a6530512d6

    SHA512

    45082bd284fd9180a1bc65e9e0453c518509529f4611451b491c368d05c7a21d929cd154f7223c19a5cb562b4bfac16a4e124c94ee98181000c27b8fe0886128

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6e4260bce24aca824e317e5ff46bd791

    SHA1

    e6718e9de889a362b1973229c209419732a55717

    SHA256

    ec993fe19c896d0e85f07bb1721fa22e49d92b99a739ede6450804e3e016a3d4

    SHA512

    e22afac702994ced642af4997b6a887ded7f141a9842b695d3bf364a184d52a7e2d2bf5e9aaf4a830779b9aa97841a2816164dfc38f4b0f762902d3aa2572608

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5793f9949c8b8d4d126f4007b3a600cd

    SHA1

    10120cda8ae87d0a2efdb7aa83ae85820ed772c1

    SHA256

    daa6abcc099aff81e21374f947dc136a326405c0b4ba0dd3febf10784c6e1195

    SHA512

    cf9dfafff61f18d67bb06ad63e1581dce8f9c285b71a5c80d58d920add11bdd696f53d4687e469c7949cf7221870e7b5f9aa0b4de392131e36d6688483cb6478

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c94cf836706e81be10bfe358ae3f1d78

    SHA1

    b83679f4de4b673db33acadd08b4fb5940937b05

    SHA256

    3fbb3d325156284927e28db10feeb657f10ed864bd80b6614b6d3d5fc147793c

    SHA512

    be1c74f6343dabae890a43a2554e07ddca2951ff5a62e7684e77829de77091ac9a8a33b52445d4a2a40ab599b2a792dfc28d877cc6ff5bf5bf13fc6c727033b7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ec79ab0fa9cc0b8110da54318a18d7d3

    SHA1

    a7a8ee24a50cbdee2dd783e591c3a19defa6e026

    SHA256

    0303a5a8f21c7c59bd1344c42bbe00ce19aac64218f91e07abfe1f5fd84bc9a9

    SHA512

    e46f695423f44f7bc38faec81b1ece445ab38ca6dc578cd6bccc9799abb4eafa689851b4572bbb7f55a846c491bc77b71b1af3137021ff567b2003cd78a8f4af

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c090e4743176be471e4dd741d2f8f905

    SHA1

    81dadc00a7faec8c955cdbcc487ff4dff1fb34c9

    SHA256

    d7750b2b817ca546b75b9f3d905e18405b7b0cf77fedcc6883eb218a831889e2

    SHA512

    04d413e5c68d8baebd600f1ccdeab7de0caea9d8a66020ab216ef9c3908253643be281da20cc9285c5da8d15d26abee0f50db787ec217b4c36335bc4d1ee6752

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    610ef24e3f71d09405ae23eee1250d5b

    SHA1

    3035f03084c4f472e3819d4b27676b68367902c2

    SHA256

    a43f1223eff6826fe3e0a09b12f317e4863b9e4b31125962844085b4574483be

    SHA512

    92b03f7f01712f21348b1649524480ded69c9811b133f30a4fff394f4be424a993a5ce59be24ae8f95a72e9248bc65d2394c750e6a0d0a40caa8072426b1013e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    038fe8d39f601ee5eb35166ab14fb5cc

    SHA1

    b68ea14c130f4ec40ae0b4458a2fb7034d5b5823

    SHA256

    862be72afcebc4ce8f910f03df887af5fa5af50474982dfc4c24a46a70ad07cd

    SHA512

    18fec77622d3dc0185523d8b7191c92b19c7eb3f34f1c47c2089bbd926f5f5795ebd7b232add9a7e3a5e902c1e867350ea7a1ea2edf010a31b7aeac01c6fd303

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5149e51ea471a0b768e88a61db626a2d

    SHA1

    aa73e8517d238bb0bcb0670ba0814d8167b8451b

    SHA256

    264c9963e07510399c56f7d683064e57f7c7a7c86f3e262b84fa7bd78a25f010

    SHA512

    1423a0f637f0cde61e05b2d5f0ea464e12565869309a46a614c6c9d1f0ad08506e6610b57727e6d404ea893d70a939d23cadc1e26b33ab8d46c4f0090561b734

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    86abdfacb4b005e0727bf3ba2da6e372

    SHA1

    b203c23ec20d02a71e43b1438b1f3ce8540b83d7

    SHA256

    25dea9c4cd0bf6478d4a7100882e6bbdd94312dcc88e026271c78f12e91e4e24

    SHA512

    98e9d6699511253de517ace8e0c7d0ccb82ce2549783861ad85595962686d8614988fe3a04dd7d99afa042420ca24a3bd72e70b9130dddff733c174aba7a3f3b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9c8607de95c64ff77b8a6012b5acd68e

    SHA1

    8dde30a11668d22fc0f2f208fdf13da6b71b2a68

    SHA256

    e0d49b65a05dd48f23216a3d4a040380ba4d6dd76af32382c21f3177ea68f44e

    SHA512

    45debdc46ac5b422af4116ef804efa926df1f2cf115e0d3adb511b5134d269721ba1c15c57f2d7bbb4a601701a13a29b62545fe4fb0ab5c7d7cadf917ba03548

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6070f7007dda21a4532c918954cfa921

    SHA1

    a7eee2208f38d11eb01e004c1b993f45311a1fd4

    SHA256

    54a821d42bf8c6b6ddb984fcadeaadf3cc43f51bc53a5074d6639318a24e90fc

    SHA512

    89733177841353a85e923a4d65711daf3494b39572237f4687241e4dcc4b76211d9b78062d81859845173579d9775081b306e9d22435af40f1dad4d7ae765583

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a1a73f525837a1dbfbc207d3503eb7fe

    SHA1

    e048e7bc00e706a98bdb85e54c631376079c3696

    SHA256

    db7f68f96cdc714da35450e71d546ac9f1617bf4a8747711db2b94f628166fe2

    SHA512

    6c1dd31b21f77013d1909cd84cc2127f3332b9fe7fb6633ae83673c72d3c5041e28f16643ed511e4b5599c08ad605f5ef93b5d4653a442549209ec8d88d3fe99

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    463562a1e29cc2f9366efa4b112ceff7

    SHA1

    eb0ca40d9e70fccfa199829dca614b64499d36ef

    SHA256

    92672f3dea07ace2c3355566adafeb328ea3585b01a9bc2dfba2b7a731847c76

    SHA512

    b21bbe074e9bd0606433ff7aa21018ffbfe73cd7ad7313ba1b439af5e51fb03ab470913c4a9c5cd3cde105684ea975d22c5af8768f0fd48b6ebb4d17e5945ea5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    374dee4a901df398a449e2638f447cfb

    SHA1

    c4b4d1665aff36c3dfb5582abd4da68f2342f5ab

    SHA256

    de80b656adc52647aabf45b0edee8637253c6f8c74f0dd21c56ab831526bf1fa

    SHA512

    ca7735759349cb4884d3e1ea1f39ff080209c9de79b8808131c87b673b00084c62fc4688535833c575ba5b16090c0f27e76a7da5a0264b4e9b61d668f74c112d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7b80c1bc3b1be6fa23546a2ec08dd15c

    SHA1

    2507e9ac72629de0229c595dbbb77a9d5005c6ad

    SHA256

    92b2d7d32222329b0478fa5ad962b7adf675a01d50fc65166623b2f0abb6a59f

    SHA512

    a6c33e1e745c923ca22f8bc51176ac914100a85f9265271df839b3877461143173516eb5eac60eafeac38d71ad27ce651bd4e9afd83423fcaf528e992f68d15f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    675b013159cc6b640463ee5c88356be8

    SHA1

    1d08d93cf7b0123f0439c78e1b3e157cf4616bc6

    SHA256

    627b7b08bb086d29864b7125603dfa46372451ba82a4d2f84401cffa62e21bbb

    SHA512

    31d4777fc6a887370b6b071c5db3732a4ab45842ef0851f6d876f4f336975572ba44f755694c1a4489b4cada6526373b026edd4b497b07363145a277688571f4

  • C:\Users\Admin\AppData\Local\Temp\Cab81BF.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Cab82DB.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar82FF.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • \Users\Admin\AppData\Local\Temp\nso318D.tmp\advsplash.dll

    Filesize

    5KB

    MD5

    15d8eee287329e2030c34c6bb3e62c87

    SHA1

    1de23c0883f7a80a489e140c55b16970dd0264ab

    SHA256

    9bf33690090655e91389469beb5dbdd45942192f2e2486c9fa82fa6d74a0f88b

    SHA512

    6ee495dcefd131ca490d6f3077643f49598184c3a49f1f66ed7a6d1559ebb9266c8c87cf49c06cdde8a6cd0643fb46f83d13aa5f27ba0c90de4791cb8bad29c0